EUVD-2026-72667
GHSA-wp7r-98f8-j5f3
Severity by source
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Physical-only attack vector; no credentials needed when device is in firmware-update mode; full C/I/A impact plausible via memory corruption and code execution.
Primary rating from Vendor (siemens).
CVSS VectorVendor: siemens
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The input received over a proprietary communication protocol that is exposed when the device is placed into a special firmware-update mode is not properly validated, resulting in a memory corruption condition. This could allow an unauthenticated attacker with physical access to the device to cause a crash and potentially execute arbitrary code on the device.
AnalysisAI
Memory corruption in Siemens Reyrolle 7SR5 digital protection relays (all versions below V2.70) allows a physically-present, unauthenticated attacker to crash the device or potentially execute arbitrary code by sending malformed input over a proprietary communication protocol exposed exclusively during the device's special firmware-update mode. Siemens confirmed the flaw via advisory SSA-142885 and released V2.70 as the fix. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Physical access to the Reyrolle 7SR5 device is a hard requirement - the vulnerable protocol is not network-accessible under any configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.0 (AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) accurately captures the dominant risk limiter: physical proximity to the device is required. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade all Reyrolle 7SR5 devices to firmware V2.70 or later as directed by Siemens advisory SSA-142885 (https://cert-portal.siemens.com/productcert/html/ssa-142885.html). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Siemens Reyrolle 7SR5 devices and document current firmware versions; assess physical security controls around device firmware-update ports to confirm access restrictions are in place. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Reyrolle 7Sr5
View allAuthentication bypass in Siemens Reyrolle 7SR5 protection relays (all firmware before V2.70) lets remote unauthenticated
Authentication impersonation in Siemens Reyrolle 7SR5 protection relays (all versions below V2.70) arises because sessio
Authentication bypass in Siemens Reyrolle 7SR5 protection relays (all firmware versions below V2.70) stems from session
Denial-of-service via resource exhaustion in the Siemens Reyrolle 7SR5 protection relay (all firmware versions before V2
Out-of-bounds write in Siemens Reyrolle 7SR5 protection relays (all firmware versions before V2.70) allows unauthenticat
Privilege escalation to administrative level is possible in the Siemens Reyrolle 7SR5 protection relay (all versions pri
Unsigned code execution on Siemens Reyrolle 7SR5 protection relays (all firmware versions before V2.70) is possible when
Unstripped debug symbols in Siemens Reyrolle 7SR5 protection relay firmware (all versions prior to V2.70) expose interna
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today